That's a good point. Indeed, that's the right way to use AES-256-CBC. There is an HMACSHA256 class available[1] which is quite straightforward to use, so I did

That's a good point. Indeed, that's the right way to use AES-256-CBC. There is an HMACSHA256 class available[1] which is quite straightforward to use, so I did not think about providing a wrapper for it in my project. It can be used like this: Set hmac = CreateObject("System.Security.Cryptography.HMACSHA256") Function HMACSHA256(key, msg) hmac.Key = B64Decode(key) HMACSHA256 = hmac.ComputeHash_2(utf8.GetBytes_4(msg)) End Function B64Decode and utf8 in the above examples are defined in the source code[2] of the project. I think it would be useful to provide convenient wrappers to compute and validate the HMAC along with the ciphertext. Thank you for this feedback. I might expose a wrapper for this later. In the meantime, if someone has the time to do this before I do it, pull requests are welcome. [1]: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.hmacsha256 https://docs.microsoft.com/en-us/dotnet/api/system.security.... [2]: https://github.com/susam/aes.vbs/blob/master/aes.vbs https://github.com/susam/aes.vbs/blob/master/aes.vbs